Corrects OpenAPI annotations for artifact, config-file and asset-version endpoints

[seb-kw]

No description provided.

[Copilot]

Pull request overview

This PR updates the API documentation (Swagger/OpenAPI) and controller annotations to better reflect the actual routing and payload formats for config-file, artifact SBOM/VEX, and asset-version endpoints.

Changes:

• Aligns several documented routes to include trailing slashes (to match Echo router registrations).
• Documents config-file endpoints as text/plain with clearer response descriptions, and adds missing project/asset config-file paths to Swagger.
• Fixes the asset-version list response schema shape in Swagger (array items definition).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
docs/swagger.yaml	Updates/extends OpenAPI paths and response content types for config-files, asset-version refs, and artifact SBOM/VEX endpoints.
docs/swagger.json	JSON equivalent of the Swagger spec updates (paths, schemas, content types).
controllers/project_controller.go	Adds Swagger annotations for project config-file GET/PUT endpoints.
controllers/org_controller.go	Corrects Swagger annotations for org config-file GET/PUT (trailing slash + text/plain).
controllers/asset_version_controller.go	Adjusts Swagger @Router paths and list response schema annotation for asset versions.
controllers/asset_controller.go	Adds Swagger annotations for asset config-file GET/PUT endpoints.
controllers/artifact_controller.go	Refines Swagger annotations for SBOM/VEX/OpenVEX and sets XML content-type headers.

Comments suppressed due to low confidence (1)

controllers/artifact_controller.go:559

• OpenVEXJSON writes a JSON document to the response writer, but (1) the swagger annotation documents it as {string} even though the response is JSON object data, and (2) the handler does not set Content-Type: application/json (unlike SBOMJSON/VEXJSON). Update the annotation to an object schema and set the response content-type before writing to ensure the implementation matches @Produce application/json.

// @Param artifactName path string true "Artifact name"
// @Produce application/json
// @Success 200 {string} string "OpenVEX document in JSON format"
// @Router /organizations/{organization}/projects/{projectSlug}/assets/{assetSlug}/refs/{assetVersionSlug}/artifacts/{artifactName}/openvex.json/ [get]
func (c *ArtifactController) OpenVEXJSON(ctx shared.Context) error {
	vex, err := c.buildOpenVeX(ctx)
	if err != nil {
		return err
	}

	return vex.ToJSON(ctx.Response().Writer)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.